Struct ForensicCatalog 

pub struct ForensicCatalog { /* private fields */ }

A queryable collection of ArtifactDescriptors with built-in decode logic.

Implementations

impl ForensicCatalog

pub const fn new(entries: &'static [ArtifactDescriptor]) -> ForensicCatalog

Create a new catalog from a static slice of descriptors.

pub fn list(&self) -> &[ArtifactDescriptor]

Return all descriptors in the catalog.

pub fn by_id(&self, id: &str) -> Option<&ArtifactDescriptor>

Look up a descriptor by its id field.

pub fn filter(&self, query: &ArtifactQuery) -> Vec<&ArtifactDescriptor>

Return all descriptors matching the given query. Every Some field in the query must match; None fields are wildcards.

pub fn by_mitre(&self, technique: &str) -> Vec<&ArtifactDescriptor>

Return all descriptors tagged with exactly the given MITRE ATT&CK technique ID.

A descriptor is normally tagged with the most specific ID it warrants, so a parent query (T1053) does not reach artifacts tagged with one of its sub-techniques (T1053.005). Use Self::by_mitre_including_subtechniques for the analyst-facing lookup, and this method when the exact tag is what matters — per-ID coverage accounting, for instance, where rolling a sub-technique up under its parent would double-count it.

pub fn by_mitre_including_subtechniques( &self, technique: &str, ) -> Vec<&ArtifactDescriptor>

Return all descriptors tagged with the given MITRE ATT&CK technique ID or any of its sub-techniques.

ATT&CK sub-technique IDs extend their parent at a . — T1053.005 is a sub-technique of T1053 — and artifacts carry the most specific ID only. A parent query therefore has to roll up, or the IDs analysts type most (T1053 Scheduled Task/Job, T1566 Phishing) return nothing at all.

The match is structural rather than a table of known IDs: a tag matches when it equals the query, or when it extends the query at a .. That separator is what keeps T1055 from swallowing T10555, and what keeps T1053.005 disjoint from its sibling T1053.002.

Matching is case-sensitive, like Self::by_mitre; ATT&CK IDs are uppercase, so normalise user input before calling.

pub fn for_triage(&self) -> Vec<&ArtifactDescriptor>

Return all descriptors sorted by triage priority descending (Critical first). Within the same priority, original catalog order is preserved.

pub fn unassessed(&self) -> Vec<&ArtifactDescriptor>

Return all descriptors that have not yet received an evidence/volatility assessment, sorted by triage priority descending.

Use this to drive demand-prioritised assessment sweeps: unassessed().first() is always the highest-impact unassessed artifact.

pub fn assessment_coverage(&self) -> (usize, usize)

Return (assessed_count, total_count) for coverage reporting.

pub fn filter_by_keyword(&self, keyword: &str) -> Vec<&ArtifactDescriptor>

Return all descriptors whose meaning or name contains keyword (case-insensitive).

impl ForensicCatalog

pub fn parsing_profile( &self, id: &str, ) -> Option<&'static ArtifactParsingProfile>

Look up parsing guidance for an artifact id.

pub fn container_profile(&self, id: &str) -> Option<&'static ContainerProfile>

Look up the container parsing layer for an artifact id.

pub fn container_signature( &self, id: &str, ) -> Option<&'static ContainerSignature>

Look up carving/recognition guidance for an artifact’s outer container.

pub fn record_signatures(&self, id: &str) -> Vec<&'static RecordSignature>

Look up carving/recognition guidance for records associated with an artifact.

pub fn decode( &self, descriptor: &ArtifactDescriptor, name: &str, raw: &[u8], ) -> Result<ArtifactRecord, DecodeError>

Decode raw data using the descriptor’s embedded decoder.

Parameters

• descriptor – the catalog entry describing the artifact
• name – the registry value name (or filename), used by ROT13 and PipeDelimited decoders
• raw – the raw byte payload of the registry value or file content